# Getting an ssl certificate **URL:** \ **Category:** Help\ **Created:** [August 24, 2021, 12:00pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461 "2021-08-24T12:00:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![sagittaracc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sagittaracc/32/52201_2.png) [@sagittaracc](https://community.letsencrypt.org/u/sagittaracc)\ **Post date:** [August 24, 2021, 12:00pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/1 "2021-08-24T12:00:36Z")
Hello there! I just have a question. Is it possible to get an ssl certificate for a computer that has no access from the internet? ---
**Author:** ![jens\_hb](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jens_hb/32/51300_2.png) [@jens\_hb](https://community.letsencrypt.org/u/jens_hb)\ **Post date:** [August 24, 2021, 1:51pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/2 "2021-08-24T13:51:09Z")
the computer that gets the cert must already have access to the internet. after that it can be installed on the computer with no access to the internet. Self-signed certs can also be used for internal use. [https://jamielinux.com/docs/openssl-certificate-authority/](https://jamielinux.com/docs/openssl-certificate-authority/) ---
**Author:** ![rmbolger](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rmbolger/32/27474_2.png) [@rmbolger](https://community.letsencrypt.org/u/rmbolger)\ **Post date:** [August 24, 2021, 2:37pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/3 "2021-08-24T14:37:10Z")
> [@sagittaracc](#): > > Is it possible to get an ssl certificate for a computer that has no access **from** the internet? Yes. No **inbound** connections are necessary when using the [dns-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) challenge type. The server only needs **outbound** access to the internet so it can reach the Let's Encrypt API servers and possibly your DNS server to publish the records unless the zone master or API endpoint is available internally. As @jens_hb mentioned, it is also technically possible to use a second machine that has the necessary internet access to obtain the certificate and then transfer it to the first machine. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 24, 2021, 3:25pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/4 "2021-08-24T15:25:05Z")
Note: Outbound access need not be direct. Indirect outbound access may also work. If you can tell someone to do it for you. And they tell someone else to do it for them. ... And it gets done. Then it will work. [provided you wait long enough for it to actually get done before telling LE to check for it being done] ---
**Author:** ![sagittaracc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sagittaracc/32/52201_2.png) [@sagittaracc](https://community.letsencrypt.org/u/sagittaracc)\ **Post date:** [August 24, 2021, 5:55pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/5 "2021-08-24T17:55:42Z")
Thank you all! One more question, can i get a cert for a computer that has no domain name but only ip? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 24, 2021, 5:56pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/6 "2021-08-24T17:56:30Z")
Not with Let's Encrypt: LE does not allow IP addresses in the certificate, just hostnames. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 24, 2021, 6:02pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/7 "2021-08-24T18:02:41Z")
Net yet! But there are plans for that. Mind you, CA certs won't ever cover IPs in RFC-1918 range. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [August 24, 2021, 6:10pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/8 "2021-08-24T18:10:02Z")
> [@rg305](#): > > Net yet! > But there are plans for that. However, those plans have been shelved indefinitely. See for more info: [Planned RFC 8738 support pulled? - #3 by josh](https://community.letsencrypt.org/t/planned-rfc-8738-support-pulled/152057/3) ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [August 24, 2021, 6:10pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/9 "2021-08-24T18:10:15Z")
I think zerossl has that but it's not on acme side so have to use web app IIRC. keep mind it have different policy so unlikely add much other name to it without paying them ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 24, 2021, 6:43pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/10 "2021-08-24T18:43:24Z")
> [@Osiris](#): > > those plans have been shelved indefinitely I've always been concerned about how to handle IP certs on shared IPs. Surely not going to be an easy task. How would the DNS-01 component for that even operate securely?!?!?! - LOL ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [August 24, 2021, 6:50pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/11 "2021-08-24T18:50:35Z")
[https://datatracker.ietf.org/doc/html/rfc8738](https://datatracker.ietf.org/doc/html/rfc8738) they don't allow dns challenge on ip address, obviously for shared hosting unless hosting provider be braindead and allow client host site on its RDNS zone, or one of client site is default page not their landing, clients won't get cert for ip ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 24, 2021, 6:53pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/12 "2021-08-24T18:53:37Z")
> [@orangepizza](#): > > they don't allow dns challenge on ip address, obviously Then it fails to be combinable with the default user request: _I need a single cert to cover my:_ - FQDN - wildcard for FQDN - IP for FQDN How can those three entries ever get onto one single LE cert? [lots of hard work will be required for sure] ---
**Author:** ![rmbolger](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rmbolger/32/27474_2.png) [@rmbolger](https://community.letsencrypt.org/u/rmbolger)\ **Post date:** [August 24, 2021, 7:00pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/13 "2021-08-24T19:00:31Z")
> [@rg305](#): > > How can those three entries ever get onto one single LE cert? Easy peasy with Posh-ACME. 😛 Each identifier in a cert order can be used with a different validation plugin. Contrived example: ```powershell $pArgs = @{ CFToken = (Read-Host 'Cloudflare Token' -AsSecureString) } New-PACertificate 'example.com','*.example.com','1.1.1.1' -Plugin Cloudflare,Cloudflare,WebSelfHost -PluginArgs $pArgs ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 24, 2021, 7:19pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/14 "2021-08-24T19:19:38Z")
Now we just need to make PowerShell on Linux systems as normal a thing as it is on Windows. Maybe there is also a simple Docker container example for the fearful/paranoid (like myself). ---
**Author:** ![aarongable](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aarongable/32/42043_2.png) [@aarongable](https://community.letsencrypt.org/u/aarongable)\ **Post date:** [August 24, 2021, 7:48pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/15 "2021-08-24T19:48:43Z")
This would be easy. Each identifier is associated with its own set of challenges that can validate that identifier. The wildcard name would only have a DNS challenge associated; the IP would have no DNS challenge associated. Fulfill all the challenges, and the cert could be issued. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [August 24, 2021, 7:51pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/16 "2021-08-24T19:51:32Z")
The problem is that most ACME clients (including certbot) don't offer split-challenge-methods between fqdn's. You would need to verify each one, one at a time with its own challenge method, then take advantage of validation caching to combine. You could group fqdn's with a common method, usually. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 24, 2021, 7:52pm UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/17 "2021-08-24T19:52:07Z")
And this can be done easily in `certbot` (our ~~biggest~~ most popular ACME client)? ---
**Author:** ![sagittaracc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sagittaracc/32/52201_2.png) [@sagittaracc](https://community.letsencrypt.org/u/sagittaracc)\ **Post date:** [August 25, 2021, 10:19am UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/18 "2021-08-25T10:19:37Z")
Could you guys, please, tell what way i should go if I want to use https with a custom web server? like if I create my own http server. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [August 25, 2021, 10:36am UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/19 "2021-08-25T10:36:26Z")
Well if you are going to encrypt, you will need a cert. LE offers FREE certs via ACME protocol. There are many ACME clients that can be used on just about every operating system known to (this) man. From there it really depends on the software that will be using the cert. ---
**Author:** ![sagittaracc](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sagittaracc/32/52201_2.png) [@sagittaracc](https://community.letsencrypt.org/u/sagittaracc)\ **Post date:** [August 25, 2021, 10:47am UTC](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461/20 "2021-08-25T10:47:58Z")
I would be really thankful if you suggest me to read something because i'm kind of new to this topic. I am creating a web application that works over web sockets with an app written on delphi using Indy web browser component or something like this i am not sure 🙂 i need to go secure. Self - signed certs don't work ☹ it always says INVALID\_CERT\_COMMON\_NAME or INVALID\_AUTHORITY. I really need to read something on this topic cuz something didn't quite add up in my mind 🙂 Thank you [Next page](https://community.letsencrypt.org/t/getting-an-ssl-certificate/158461.md?page=2)